The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild.

The threat group’s remarkable success targeting open-source software was inevitable and fueled by the industry’s decision to prioritize code shipping over security.